Determining root cause
Methods, systems, and computer-readable media with executable instructions stored thereon for determining root cause are provided. A method for determining root cause can include receiving values for at least one performance metric for each of a plurality of components of an IT system to establish a normal value for each of the performance metrics, receiving an abnormal value that differs from the normal value for at least one of the plurality of components of the IT system, and determining a probability that the at least one of the plurality of components of the IT system is a root cause of the abnormal value.
1. A method for determining root cause, comprising:
receiving values for at least one performance metric for each of a plurality of components of an IT system to establish a normal value for each of the performance metrics;
receiving an abnormal value that differs from the normal value for at least one of the plurality of components of the IT system; and
determining a probability that the at least one of the plurality of components of the IT system is a root cause of the abnormal value, wherein determining the probability includes a statistical calculation of a complementary value (P(m j )) of a baseline confidence that determines the abnormal value is abnormal behavior rather than systemic noise and determine a temporal probability (R 1 (m j )) by the equation: R 1 (m j )=P(m j ) (T(m j )) , where T(m j )={t b −t j ,t b >t j ;0,t b ≦t j }, t b is a time the abnormal value is received, and t j is a time the abnormal behavior begins.
2. The method of claim 1 , wherein determining the probability that the at least one of the plurality of components of the IT system is the root cause of the abnormal value includes determining a probability that the abnormal value is abnormal behavior rather than systemic noise.
3. The method of claim 1 , wherein determining the probability that the at least one of the plurality of components of the IT system is the root cause of the abnormal behavior includes determining a temporal consistency of received abnormal values.
4. The method of claim 3 , wherein determining the probability that the at least one of the plurality of components of the IT system is the root cause of the abnormal behavior includes determining a number of abnormal behaviors associated with each of the plurality of components of the IT system.
5. The method of claim 4 , wherein determining the probability that the at least one of the plurality of components of the IT system is the root cause of the abnormal behavior includes determining an average number of abnormal values associated with each of the plurality of components of the IT system.
6. A non-transitory computer-readable medium storing a set of instructions executable by a computer to cause the computer to:
receive values for at least one performance metric for each of a plurality of components of an IT system to establish a normal value for each of the performance metrics;
receive an abnormal value that differs from the normal value for at least one of the plurality of components of the IT system;
determine a probability that the at least one of the plurality of components of the IT system is a root cause of the abnormal value, wherein the probability determination includes a statistical calculation of a probability that the abnormal value is abnormal behavior rather than systemic noise; and
determine a temporal probability as an exponential function of the probability that the abnormal behavior is actual abnormal behavior rather than systemic noise.
7. The non-transitory computer-readable medium of claim 6 , wherein the set of instructions executable by a computer cause the computer to determine a temporal consistency of received abnormal values as a function of the temporal probability and a number of received abnormal values and a number of normal values.
8. The non-transitory computer-readable medium of claim 7 , wherein the set of instructions executable by a computer cause the computer to determine a value corresponding to a number of abnormal values for each of the plurality of components of the IT system, wherein each value is equal to a product of a number of performance metrics having received values for each of the plurality of components of the IT system and the temporal consistency having a logarithm base m exponent, wherein m is an adjustable variable.
9. The non-transitory computer-readable medium of claim 8 , wherein the set of instructions executable by a computer cause the computer to determine an average of the values corresponding to the number of abnormal values for each of the plurality of components of the IT system.
10. A system for determining root cause, the system comprising a normal value engine, an abnormal value engine, and a probability engine, wherein:
the normal value engine is configured to receive values for at least one performance metric for each of a plurality of components of an IT system and to establish a normal value for each of the performance metrics;
the abnormal value engine is configured to receive an abnormal value that differs from the normal value for at least one of the plurality of components of the IT system; and
the probability engine is configured to determine a probability that the at least one of the plurality of components of the IT system is a root cause of the abnormal value, wherein the probability determination includes a statistical calculation of a complementary value (P(m j )) of a baseline confidence that determines the abnormal value is abnormal behavior rather than systemic noise and determine a temporal probability (R 1 (m j )) by the equation: R 1 (m j )=P(m j ) (T(m j )) , where T(m j )={t b −t j ,t b >t j ;0,t b ≦t j }, t b is a time the abnormal value is received, and t j is a time the abnormal behavior begins.
11. The system of claim 10 , wherein the probability engine is configured to determine a temporal consistency (R 2 (m j )) by the equation: R 2 (m j )=R 1 (m j ) (A j +1−N j /w) , where A j is a number of abnormal values detected, N j is a number of normal values detected, and w is a weight of normal values to abnormal values.
12. The system of claim 11 , wherein the probability engine is configured to determine a number (R a (m j )) of abnormal values for each of the plurality of components of the IT system by the equation: R a (m j )=R 2 (m j ) log m M i , where m is an adjustable variable and M i is a number of performance metrics for a component i of the IT system.
13. The system of claim 12 , wherein the probability engine is configured to determine an average (P(n i )) of the values corresponding to the number of abnormal values for each of the plurality of components of the IT system by the equation:
P
(
n
i
)
=
1
M
i
∑
j
R
a
(
m
j
)
.